Don't fail if a candidate certificate has no SANs

Don't return an error, which will eventually cause the module to just
return an error, if we don't find any SANs in the candidate certificate:
just return the empty list of values so that processing can continue on
to other certificates.
Make the text of NSS's prompts look like OpenSSL's

When built with NSS, make the text of prompts that we issue to the user
better mirror the text we use when we build with OpenSSL.
Only call SEC_PKCS12DecoderFinish() once

We already call SEC_PKCS12DecoderFinish() before entering the switch()
statement, so don't call it again.  Failures to parse PKCS12 data due to
reasons other than not having a decryption password probably didn't end
well before now.
Traverse tokens like we do with OpenSSL for NSS

When built with NSS, change our token traversal strategy to mimic the
way we do things when we're using OpenSSL: forget about slot names, and
only look at the specified token, or the first one if one isn't
specified.
When DEBUG=1, log why we fail to log in to a token
NSS: load certificates first

In order to work around RHBZ#859535, when loading a certificate and a
key, switch to loading the certificate first.
Fix loading of certificates

When loading certificates using the PEM module, use a better method for
finding the just-loaded certificate that doesn't break if we've already
got a copy of the certificate somewhere.
NSS: support encrypted PEM keys

When the PEM module is given an encrypted key, it changes its status to
indicate that a password is required.  So if we detect that after
loading a private key, attempt to "log in" to the "token" using a
password.  Even if we fail, we'll have reset the needs-login flag, which
is necessary before we can import anything else.